Hacker News Reader

session token/cookie should expire to prevent user info from being viewable, whether or not google indexes it.

Some of the pages load and show full details even when you open them in an incognito window.

Really hoping for a reply from AMC but I don't expect one.

I also wondered if they might be test pages of some sort but they look legitimate.

If google caches it quickly, it'd be viewable for a long time after the tokens have expired?

No - the session cookie is private to the browser that originally placed the order, so the Google crawler should get a 403 as it doesn't have that cookie.

Reply on news.ycombinator.com